Reply to this post | Go Back

View Post [edit]

Poster:	brewster	Date:	June 11, 2003 04:39:04pm
Forum:	sflan	Subject:	about 270 different users "associating" with sflan!

I am not expert, but it looks like about 270 different mac address have associated to at least one sflan node in the last 5 days.

this strikes me as high, especially since we see very little traffic.

but if it is anywhere close, then we are getting somewhere!

-brewster

Reply to this post

Reply [edit]

Poster:	akb	Date:	June 11, 2003 05:13:07pm
Forum:	sflan	Subject:	Re: about 270 different users 'associating' with sflan!

How are you counting? I run a couple of open nodes and I believe a goodly percentage of the connections I get are accidental. I run a captive portal (nocat) so that users can accept a EULA and optionally register for a free VPN service. The logs showed many of the associations were people that tried to connect to MS's Windows Update or some sort of spyware service like Moxie and nothing else, I assume these are accidental.

Accidental connections are one one reason I like the captive portal idea. For users that stumble across your service but have no idea what is going on you get a chance to explain it to them. Other benefits are you get to show them some content that's local to the wireless network (ie linux iso's), explain to them the security risks that they have in using wireless (and offer them a vpn), and let them know the terms of service.

Reply to this post

Reply [edit]

Poster:	brewster	Date:	June 12, 2003 12:57:04am
Forum:	sflan	Subject:	Re: about 270 different users 'associating' with sflan!

Good points. What I did was this:

zcat /var/log/syslog*.gz | grep "association request" | /tmp/av_cw | cut -f10 -d" " | sort | uniq -c | sort -nr

the full lines in the syslog say this (XX to protect privacy):
Jun 9 08:40:38 sflan11 kernel: netcs0: association request: from 00:02:8a:40:XX:XX to 00:09:b7:13:XX:XX len=19

clif will be putting in the "real thing" of an snmp monitor. I just got excited.


On the front nocat type page: that sounds like a good idea for all the reasons you said. we are not there yet.

-brewster